Minutes of the meeting of the Audit and Compliance Committee of the Board of Directors of the Cook 
County Health and Hospitals System held Friday, March 15, 2019 at the hour of 9:00 A.M. at 1950 W. Polk 
Street, in Conference Room 5301, Chicago, Illinois. 


I. Attendance/Call to Order 

Acting Chair Koetting called the meeting to order. 

Present: Acting Chair Mike Koetting and Directors Hon. Dr. Dennis Deer, LCPC, CCFC; Ada Mary 

Gugenheim; and Robert G. Reiter, Jr. (4) 

Directors Mary B. Richardson-Lowry and Sidney A. Thomas, MSW (Substitute Members) 

Telephonically 

Present: Board Chair M. Hill Hammock (1) and Gerald Bauman (Non-Director Member) 

Absent: Director Layla P. Suleiman Gonzalez, PhD, JD (1) 


Director Gugenheim, seconded by Director Thomas, moved to allow Board Chair 
Hammock to telephonically participate in the meeting as a voting member. THE 


MOTION CARRIED UNANIMOUSLY. 


Additional attendees and/or presenters were: 


Cathy Bodnar - Chief Corporate Compliance and 
Privacy Officer 

Debra Carey - Deputy Chief Executive Officer, 
Operations 

Elizabeth Festa - CountyCare Compliance Officer 
Jeff McCutchan -General Counsel 


Deborah Santana - Secretary to the Board 
Tom Schroeder - Director of Internal Audit 
John Jay Shannon, MD - Chief Executive 
Officer 

Dianne Willard - CCHHS Compliance Officer 


II. Public Speakers 

Acting Chair Koetting asked the Secretary to call upon the registered public speakers. 
The Secretary responded that there were none present. 


III. Report from Chief Corporate Compliance and Privacy Officer (Attachment #1 ) 

• Annual Report - Cook County Health as a Provider of Health Care Services 

• Annual Report - CountyCare Medicaid Health Plan 

Cathy Bodnar, Chief Corporate Compliance and Privacy Officer, provided an overview of the information 
contained in the Report. Dianne Willard, CCHHS Compliance Officer, and Elizabeth Festa, CountyCare 
Compliance Officer, provided additional information. The Committee reviewed and discussed the 
information. 
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III. Report from Chief Corporate Compliance and Privacy Officer (continued) 

The report included information on the following subjects: 

• Background and Metrics 

• Organizational Chart 

• Year-Over-Year Comparison 

• Metrics/Annual Reports: 

- Cook County Health as a Provider of Health Care Services 

- CountyCare Medicaid Health Plan 


IV. Action Items 


A. Minutes of the Audit and Compliance Committee Meeting, November 15, 2018 

Director Reiter, seconded by Director Gugenheim, moved to accept the minutes of 
the Audit and Compliance Committee Meeting of November 15, 2018. THE 
MOTION CARRIED UNANIMOUSLY. 


B. Review and approve Internal Audit Charter (Attachment #2) 

Tom Schroeder, Director of Internal Audit, provided an overview of the Internal Audit Charter. He indicated 
that he is proposing only cosmetic changes to the Charter to update it, including changing references of CCHHS 
to reflect the recent change to “Cook County Health.” 

Director Suleiman Gonzalez, seconded by Director Gugenheim, moved to approve 
the proposed changes to the Internal Audit Charter. THE MOTION CARRIED 
UNANIMOUSLY. 


C. Any items listed under Sections IV and V 


V. Closed Meeting Items 

A. Report from Director of Internal Audit 

B. Discussion of Personnel Matters 

Director Reiter, seconded by Director Gugenheim, moved to recess the open meeting 
and convene into a closed meeting, pursuant to the following exceptions to the 
Illinois Open Meetings Act: 5 ILCS 120/2(c)(l), regarding “the appointment, 
employment, compensation, discipline, performance, or dismissal of specific 
employees of the public body or legal counsel for the public body, including hearing 
testimony on a complaint lodged against an employee of the public body or against 
legal counsel for the public body to determine its validity,” and 5 ILCS 120/2(c)(29), 
regarding “meetings between internal or external auditors and governmental audit 
committees, finance committees, and their equivalents, when the discussion involves 
internal control weaknesses, identification of potential fraud risk areas, known or 
suspected frauds, and fraud interviews conducted in accordance with generally 
accepted auditing standards of the United States of America.” 
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V. Closed Meeting Items (continued) 

On the motion to recess the open meeting and convene into a closed meeting, a 
roll call was taken, the votes of yeas and nays being as follows: 

Yeas: Acting Chair Koetting, Board Chair Hammock and Directors Deer, 

Gugenheim and Reiter (5) 

Nays: None (0) 

Absent: Director Suleiman Gonzalez (1) 

THE MOTION CARRIED UNANIMOUSLY and the Committee convened into 
a closed meeting. 

Acting Chair Koetting declared that the closed meeting was adjourned. The 
Committee reconvened into the open meeting. 


VI. Adjourn 


As the agenda was exhausted, Acting Chair Koetting declared the meeting 
ADJOURNED. 


Respectfully submitted, 

Audit and Compliance Committee of the Board of Directors of the 
Cook County Health and Hospitals System 


xxxxxxxxxxxxxxxxxxxxxx 

Mike Koetting, Acting Chair 


Attest: 


XXXXXXXXXXXXXXXXXXXXXX 
Deborah Santana, Secretary 


Requests/Follow-up: 

There were no requests for follow-up at this meeting. 
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Meeting Objectives 

Review 

Background & Metrics 

• Organizational Chart 

• Year-Over-Year Comparison 

• Metrics 

o Cook County Health as a Provider of Health Care Services 
Provider Annual Report 
o CountyCare Medicaid Health Plan 
■ CountyCare Annual Report 

Action 

• Annual Education (4-Required Modules) 
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2018 Contacts by Category 

CCH as a Provider of Care 


Regulatory/Policy 

13% 


Contract 

8 % 


Theft 

i% 


Fraud Waste Abuse 
2 % 


Other 

8 % 


Human Resources 
22 % 



False Claims 

i% 


Conflict of Interest 
3% 


Accurate Books 
10 % 


Privacy/ Security 
32 % 


Categories 


Privacy/Security (HIPAA) 237 

Human Resources 163 

Regulatory/Policy 94 

Accurate Books 73 

Contracts 60 

Conflict of Interest 26 

Fraud Waste & Abuse 15 

False Claims 7 

Theft 4 

Other 61 


740 
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2018 Proactive vs. Reactive Activity 

CCH as a Provider of Care 

Reactive activities are unanticipated contacts, queries, or concerns. 
Proactive activities anticipate possible issues. 



While proactive activity is optimal, reactive activity is not viewed negatively 
by Corporate Compliance. A majority of reactive contacts indicate 
cook county awareness of the Compliance Program as an organizational resource. 
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Fraud, Waste and Abuse Metrics 


State Fiscal Year (S-FY) 2018 through S-FY19 Q1 


S-FY 

Reporting Quarter 

Tips 

Preliminary 

Investigations 

Full 

Investigations 

Referrals to 

HFS OIG 

Provider 

Audits 

Overpayments 
Identified * 2 

Overpayments 

Collected 

18 

Qi 07/01 -09/30/17 

1 

11 

3 

3 

3 

$ 97,910.84 

$ 

2,574.00 

18 

02 10/01 -12/31/17 

2 

8 

9 

1 

1 

$ 201,038.64 

$ 

2,961.36 

18 

Q-3 Ol/Ol - 03/31/18 ** 

70 

5 

15 

2 

103 

$ 457,24529 

$ 

6,09785 

18 

04 O4/OI - 06/30/18 

6 

5 

9 

2 

57 

$ 2 , 305.95974 

$ 

28,216.99 

19 

Qi 07/01 -09/30/18 

15 

34 

11 

0 

173 

$ 694,801.54 

$ 

44,38525 


* x The 3 rd Quarter S-FY 18 was significant for CountyCare Compliance. Evolent, CountyCare’s TPA for medical and behavioral health hired 
two (2) local investigators dedicated solely to program integrity efforts. This dedicated team partnered with a data analytics firm to review 
claims for anomalies. The result of this activity is apparent in the metrics above. 


* 2 The Overpayments Identified column indicates the total amount paid to the provider for the identified inaccurate codes. These amounts 
may be offset if a provider elects to bill a corrected claim. 

Example : The highest level clinic visit is billed to the health plan, reimbursement is $48, the medical record is reviewed and the 
documentation validates a lower level. The “Overpayment Identified” is $48, however the provider may rebill a lower level and 
expect corresponding reimbursement of $28.35. This category does not account for the net recovery of $19.65. 
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2018 Contacts by Category 

CountyCare Health Plan 


Categories 


Privacy/Security (HIPAA) 
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Human Resources 
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I. Introduction 

Cook County Health (CCH) Corporate Compliance incorporates two (2) distinct Compliance 
Programs: CCH as a provider of health care services and the CountyCare Medicaid Health Plan. 
Provider services occur within both CCH hospitals (John H. Stroger, Jr. Hospital of Cook County 
and Provident Hospital of Cook County), multiple outpatient clinics, correctional medicine at the 
Cook County Jail and Juvenile Temporary Detention Center, and the Cook County Department of 
Public Health. It also includes physicians and others that provide direct care to patients, and 
workforce members not directly involved in patient care. Although the CountyCare Medicaid 
Health Plan’s Compliance Program is addressed through a separate annual report, both programs 
function at the system level and are committed to the mission of Cook County Heath: 

“To deliver integrated health services with dignity and respect regardless of a patient’s 
ability to pay; foster partnerships with other health providers and communities to enhance 
the health of the public; and advocate for policies which promote and protect the physical, 
mental and social well-being of the people of Cook County.” 

Corporate Compliance supports CCH’s Mission through a departmental Mission updated and 
approved by the Audit and Compliance Committee of the Board of Directors on September 20, 
2018. The mission reads, 

“The Corporate Compliance Program upholds the mission, vision, and core values of Cook 
County Health by: 

■ Developing standards to guide everyone affiliated with CCH to “Do the Right Thing” 

■ Increasing compliance awareness through education and training 

■ Promoting collaboration, honest behavior, mutual respect, and professional 
responsibility 

to support compliance with applicable laws, regulations, and system-wide policies.” 

Corporate Compliance similarly updated the Compliance Vision statement: 

“To ensure safeguards are in place for our patients, health plan members, health plan 
providers, the residents of the county of Cook, and our workforce members, staff, and 
the public at large, the Corporate Compliance Program will be a resource to everyone 
affiliated with and cared for by Cook County Health.” 

(For the purposes of this statement, “affiliated” is defined as all patients, health plan 
members, health plan providers, the residents of the county of Cook, and workforce 
members that include employees, medical staff, house staff, Board members, volunteers, 
students, partners, consultants, agency personnel, and vendors.) 

This Annual Report presents the activities throughout County fiscal year 2018 of the CCH 
Provider Corporate Compliance Program under the executive leadership of Cathy Bodnar, Chief 
Compliance and Privacy Officer, and the operational leadership of Dianne Willard, Compliance 
Officer. This report also serves to demonstrate the effectiveness of the compliance program by 
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looking at infrastructure, communication strategy and channels. In addition, this report provides 
an assessment of the CCH Provider Compliance Program by using the seven (7) Compliance 
Program Elements of a comprehensive compliance program delineated by the Office of Inspector 
General (OIG). 


II. Building Blocks — Program Infrastructure and Scope 


The Annual Report begins with a look at the activities of the Program that incorporate efforts to 
foster an infrastructure that produces a comprehensive compliance program. The existing 
Departmental Organization Chart follows: 



The lightly shaded positions indicate the new hires within FY18. Four (4) of the 7-positions within 
Corporate Compliance were filled within the fiscal year, including the Compliance Officer 
assigned to CountyCare. Although this placed a significant strain on the existing resources, the 
performance by the existing team members was noteworthy. Management of the core elements 
of the Program continued while an individualized development plan for each new team member 
was undertaken. This was critical to the success of each individual and the Program overall. 


Corporate Compliance Program Scope 


Cook County Health activities that fall into the Corporate Compliance purview are: 

■ Interpretation of laws, rules, and regulations and organizational policy as they relate 
to Corporate Compliance; 
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■ Accurate Books and Records; 

■ Anti-kickback Activities; 

■ Conflict of Interest; 

■ Emergency Medical Treatment and Labor Act (EMTALA); 

■ False Claims; 

■ Financial Integrity; 

■ Fraud, Waste, and Abuse; 

■ Integrity in both Marketing and Purchasing Practices; 

■ Patient Privacy, Confidentiality, and Security (HIPAA); 

■ Research, Clinical Trials, and Grant Compliance; and 

■ Undue Political Activity/ Operational Influence. 


III. Being Present — Communication — Fostering Transparency 

A. Communication Strategy 

The ongoing organizational compliance communication strategy has been to increase the 
CCH workforce awareness of the following topics: 

■ Code of Ethics; 

■ Privacy, Confidentiality, and Security; 

■ Accessibility of the Compliance Officer and the compliance team; 

■ Availability through multiple modalities; 

■ Responsibility to report potential/actual issues; and 

■ Non-retaliation. 

B. Communication Channels 

Within FY18, the Corporate Compliance Program communicated the aforementioned 
topics utilizing multiple formats: 

■ E-mail communications; 

■ Organizational newsletters (System Briefs); 

■ Record Retention guidance; 

■ Annual education; 

■ Screen savers; 

■ Attendance/presence at team meetings; 

■ Compliance Program business cards; 

■ Pens with the compliance hot line number; 

■ Privacy Protector wrist bands; 

■ Code of Ethics posters; and 

■ Dual employment and conflict of interest reporting. 
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IV. Compliance Program Structure: Performance of the Elements 


Element l 

The development and distribution of written Code of Ethics, as well as written policies and 
procedures that promote the hospital’s commitment to compliance (e.g., by including adherence 
to compliance as an element in evaluating managers and employees) and that address specific 
areas of potential fraud, such as claims development and submission processes, coding and 
billing risk areas, and financial relationships with physicians and other healthcare 
professionals. 

A. Policies and Procedures & Work Plan Activities 

Policies and Procedures 

Developed, updated, and performed triennial reviews on multiple system policies 
related to general compliance, governance, and HIPAA. Functioned as a reviewer for 
numerous organizational policies with compliance and/or privacy elements. Continue 
to participate on the CCH Policy Review Committee to ensure uniform system-wide 
standards are met. 

Work Plan Activities 

In addition to policy and procedure activity, Corporate Compliance worked with 
operational areas to assess compliance with procedures and/or regulatory 
requirements. 

■ Annual Education 

Responsibility for the ongoing operations and day-to-day management of the 
CCH electronic learning management system (LMS) for all mandatory annual 
training for the entire CCH workforce (employees and contractors) was 
transitioned to Wayne Wright, Director of Organizational Development and 
Training in Human Resources. 

Corporate Compliance remained subject matter expert for two (2) mandatory 
annual education modules, Fraud, Waste, and Abuse and Code of Ethics. Both 
modules were updated in to comply with regulatory and contractual 
requirements. In addition to maintaining responsibility for other elective 
modules relating to safeguarding protected health information. 

■ Record Retention 

As a government entity, all documents must be reviewed to determine if they 
are considered “public records.” Public record is defined in 50 ILCS 205/3 is 
defined as “(a)ny book, paper, map, photograph or other official 
documentary material, regardless of physical form or characteristics, made, 
produced, executed or received by any agency...or in connection with the 
transaction of public business and preserved...as evidence of the 
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organization, function, policies, decisions, procedures, or other activities 
thereof, or because of the informational data contained therein. 

CCH follows an approved Application for Authority to Dispose of Local 
Records, known as the Record Retention Schedule. The Schedule dates back to 
1985, it contains 1,237 pages with 4,395 different records and retention 
periods. Over the past year, Corporate Compliance has requested and received 
permission to destroy each record on the Records Retention Schedule based 
upon the regulatorily defined retention period. 

With the completion of the new Professional Building at 1950 West Polk, 
Corporate Compliance coordinated significant efforts to educate staff on record 
retention and appropriate record destruction. Corporate Compliance also 
worked with Health Information Management to walk through each floor of 
the Administrative Building and communicate proper identification and 
retention of documents prior to the Administrative Building being vacated by 
a majority of its workforce. 

Departmental efforts with the aforementioned activity deferred a project to 
update the current Record Retention Schedule to a leaner, more intuitive 
document for Cook County Health. This project remains on the Corporate 
Compliance work plan for FY19. 

■ Dual Employment and Accounting of Disclosure Surveys 

To support organizational transparency, worked with Business Intelligence to 
internally develop a survey for all Cook County Health employees that 
combines two (2) elements, dual employment and conflict of interest. 

Completion of an annual Dual Employment survey is required whether or not 
a CCH employee participates in external employment. This requirement is 
promulgated by the Rules of the Board of the Cook County Commissioners, 
CCH Dual Employment Policy and CCH Personnel Rules. 

Historically, a subgroup of CCH employees, those that influence procurement 
or function in any decision-making capacity on behalf of CCH, were required 
to disclose additional information related to external relationships and 
activities. The purpose of this survey is to assess whether a conflict of interest 
exists. This survey is a mandatory requirement pursuant to the CCH Conflict 
of Interest policy. This year, the conflict of interest questions were incorporated 
with the dual employment questions resulting in one survey for all employees. 
This survey collects employee disclosures for review by leadership. 


Page 7 


28 of 65 





Cook County Health 

Compliance Program 

ANNUAL REPORT - FY18 


The survey requires a two-step review process. Once completed by an 
employee, the survey is submitted to their operational leader. The operational 
leader reviews the submission. Once reviewed and approved, the survey is 
routed for a secondary review by the operational leader’s supervisor. At each 
step of the review, the reviewer has the ability to reject a submission, sending 
the survey back to the individual for more specificity. Summary information 
will be compiled and shared with the Corporate Compliance Executive Steering 
Committee. 

■ 340B Compliance 

Administered through the Health Resources and Services Administrations 
(HRSA) Office of Pharmacy Affairs, the 340B Drug Pricing Program has 
significant program integrity requirements. Corporate Compliance continued 
to function as a resource for the organization’s 340B Drug Pricing Program 
managed within the Department of Pharmacy that requires drug 
manufacturers to provide outpatient drugs to eligible health care organizations 
such as CCH at significantly reduced prices. 


Element 2 

The designation of a Chief Compliance Officer and other appropriate bodies, e.g., a corporate 
compliance committee, charged with the responsibility of operating and monitoring the 
compliance program, and who reports directly to the CEO and the governing body. 


B. 


Compliance Office and Committees 

The graphic below illustrates the communication and reporting structure. Cathy Bodnar, 
the Chief Compliance & Privacy Officer, reports to the CCH Audit & Compliance 
Committee of the Board and the CCH Chief Executive Officer. In turn, the CCH Audit & 
Compliance Committee of the Board and the CCH Chief Executive Officer each report to 
the CCH Board of Directors. 
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The primary duties of the Chief Compliance & Privacy Officer include the following: 

■ Serving as an internal consultant and resource for compliance and matters; 

■ Overseeing and monitoring the ongoing functions of the Corporate Compliance 
Programs for both the CCH provider side of the system and the CountyCare health 
plan; 

■ Participating in regular, CCH-wide risk assessments to understand potential 
vulnerabilities; 

■ Acting as the Privacy Officer for CCH to assure compliance with HIPAA regarding 
protection of patient and member health information; 

■ Reporting on a regular basis to the CCH governing bodies; 

■ Periodically revising the Corporate Compliance Program Plan, with input from the 
Audit & Compliance Committee of the Board of Directors and Executive 
Management in light of changes directed to the needs of CCH and the laws and 
policies of federal, state, and county bodies; 

■ Developing, coordinating and participating in training programs that focus on the 
elements of the Corporate Compliance Program and providing training such that 
workforce members are knowledgeable of and comply with the Code of Ethics, 
compliance policies, laws and regulations; 

■ Coordinating and overseeing compliance auditing and monitoring activities; 

■ Responding to reports of issues or suspected violations related to compliance by 
independently investigating these matters, as appropriate, and working with 
operational leadership, Human Resources, and General Counsel in the 
determination of corrective action warranted based on policies; 

■ Assuring, through consultation with Human Resources and General Counsel, that 
guidance provided through CCH disciplinary policies are applied fairly, equitably, 
appropriately, and consistently; 

■ Developing policies and programs that encourage CCH personnel to report 
suspected fraud and other improprieties without fear of retaliation or retribution; 
and 

■ Reviewing and incorporating updated compliance, privacy, and security language 
within agreements and contracts to require third party vendors’ adherence to 
applicable regulations and laws. 

The Audit & Compliance Committee of the Board advises the CCH Board of 
Directors regarding the implementation of standards and processes to assure 
professional responsibility and honest behavior, compliance with regulatory 
requirements, and risk management. 

In addition to the aforementioned relationships, the Chief Compliance and Privacy Officer 
receives support and guidance from the internal Corporate Compliance Executive 
Steering Committee, an assembly of executive leaders within CCH, including but not 
limited to, the CEO, Deputy CEO, System Director of Internal Audit, Chief Medical Officer, 
and others. 
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Element ^ 

The development and implementation of regular, effective education and training programs for 
all affected employees. 

C. Education and Training 

1. New Employee Orientation 

Presented an “Introduction to Corporate Compliance and HIPAA”, at twenty-seven 
(27) orientation session speaking to over 1,200 workforce members. 

2. Targeted Education 

Provided thirty-seven (37) additional education training sessions to 485 attendees. 
Continued utilizing interactive training sessions which focused on story-telling as 
a means to communicate information on HIPAA and CCH policies. Focused on 
current matters brought to Corproate Compliance attention, the impact on 
patients, and proactively improving compliance to areas such as, 
o Resident program coordinators; 
o Residents in surgical units; 
o Patient Access Department; 
o Outpatient clinics; 
o CORE Center; 

o Physical Therapy/Occupational Therapy; 
o Oak Forest Mail Order Pharmacy; and 

o Correctional Health at Juvenile Temporary Detention Center. 

3. Annual Compliance Education 

As noted earlier in this report, updated two (2) annual education modules on the 
Code of Ethics and Fraud Waste and Abuse. 

Element 4. 

The maintenance of a process, such as a hot line, to receive complaints, and the adoption of 
procedures to protect the anonymity of complainants and to protect whistleblowers from 
retaliation. 

D. Effective Lines of Communication — Receiving and Responding to Complaints 

1. Infrastructure Activities 

a. Assisted our workforce members through: 

■ A hot line service by a third party to preserve anonymity if 
desired. The individual is given a code number related to their 
report, and can call back or check the website using that code 
number to review comments and updates. 

■ A separate toll-free number for privacy breaches. 
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2 . 


■ Expanded role in collaborating with Patient Relations to assist 
in resolving compliance-related issues. 

b. Managed two (2) e-mail addresses for Compliance 
fcompliance@cookcountvhhs.orgl and Privacy 
fprivacv@cookcountvhhs.orgl . 

c. Established and engaged internal and external resources to assist with 
investigations and provide governmental and national perspectives on 
compliance issues. 

d. Identified trends and patterns to mitigate organizational risks and 
facilitate operational improvement. 

e. Presented trends and patterns to the Audit and Compliance Committee 
of the Board. 

Process for Responding to Inquiries, Issues and Complaints 
The work flow process follows: 

a. Investigate the allegation; 

b. Determine the areafs) affected; 

c. Collaborate with operational leadership and appropriate departments; 

d. Review and follow organizational policy, federal, state, and county 
regulations related to the incident for mitigation and remediation. 
These may include further auditing of documentation, mitigating harm 
and potentially informing the appropriate government entity; 

e. Follow HIPAA breach notification rules that require sending a 
notification and apology letter to the affected individualfs), reporting 
to the Centers for Medicare and Medicaid (CMS), and, in the case of 
breaches that affect over 500 individuals, notifying the media; 

f. Collaborate with operational area to determine and facilitate a 
corrective action plan including education as needed; 

g. Respond to the complainant; and 

h. Respond to governmental entities as required by law. (e.g. CMS, OCR, 
HFS). 

All contacts brought to the attention of Corporate Compliance are tracked through 
a web-based tracking tool. The Compliance Program utilized one vendor for 8- 
years to maintain consistency in tracking and monitoring. With the advancement 
of technology, it was prudent to assess the current marketplace. A Request for 
Proposal was posted, and six (6) vendors responded. A committee evaluated the 
respondents and chose a vendor based upon their commitment to provide hands- 
on management of the project and full implementation of the Compliance Issue 
Tracking Tool and leveraging a partnership with Salesforce, an existing CCH 
vendor currently utilized within Human Resources, to provide the software 
platform. 
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The overarching goal of the process is to assure consistency and to implement 
protections for our patients/members, the organization, our workforce, the 
government and the taxpaying public at large. The diagram that follows illustrates 
the approach to incident investigation and ensures that all the causes are 
uncovered and addressed by appropriate actions. 



3. Contact Volumes 

In FY18, 740 identified contacts were documented for the CCH Provider 
Compliance Program. The chart that follows illustrates the year-over-year activity 
which shows an increase of 120% compared to the previous fiscal year. 
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4. Contact Breakdown by Category 

Categories have been defined that parallel the CCH Code of Ethics. The inclusion 
of a contact in a specific category does not substantiate the contact as a concern; 
rather it classifies the contact within a defined category. 
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The categories are classified as follows: 

■ Accurate Books and Records 

■ Conflict of Interest 

■ Contracts* 

■ False Claims 

■ Healthcare Fraud, Waste and Abuse 

■ HIPAA Privacy, Confidentiality and Security 

■ Human Resources 

■ Research 

■ Regulatory/Policy 

■ Theft 

■ Other 

* Based upon the volume of activity surrounding contract review, separated this 
category from the previous category of Regulatory/Policy/Contract 

5. FY18 Contacts by Category 
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The majority of the contacts, 237 or 32%, were categorized within HIPAA Privacy. 
This percentage is consistent with previous years. Of the documented contacts 
categorized as HIPAA Privacy, approximately 15% or 37 contacts were confirmed 
privacy breaches that resulted in a total of 82 patient notifications. 

The CCH Provider side of the Compliance Program provides support to the health 
plan for privacy issues. CountyCare experienced one (1) privacy breach that 
resulted in a total of five (5) member notifications. The one CountyCare breach in 
FY18 was caused by a Business Associate. 

6. FY18 Contact Status 

Of the 740 contacts were addressed throughout FY18, 96% or 709 contacts were 
resolved. Of the contacts resolved, More than 99% were either managed internally 
by Corporate Compliance or Corporate Compliance partnered with another area to 
address the concerns raised. Less than 1% were referred to other areas external to 
Corporate Compliance for management and follow-up. This metric is consistent 
year-over-year. The remaining 31 contacts were remained open at the end of the 
fiscal year and were carried over to FY19. 

7. FY18 Proactive vs. Reactive 
Of the 740 provider contacts managed during FY18, 

29% or 218 contacts were proactive. The proactive 
category is defined as subjects, brought to the 
attention of Corporate Compliance by individuals 
seeking guidance prior to the occurrence of an 
event or activity. This percentage has decreased 
from 40% in FY17. The remaining 522 contacts or 
71% were reactive. Reactive contacts are defined as 
contacts that occurred that were reported to Corporate Compliance after the 
occurrence. 

Element 5 

The development of a system to respond to allegations of improper/illegal activities and the 
enforcement of appropriate disciplinary action against employees who have violated internal 
compliance policies, applicable statutes, regulations or Federal health care program 
requirements. 

E. Enforcing Standards 

Broadened the scope of Standards enforcement through: 

1 . Breach Assessments. Reviewed investigations and provided remediation guidance 
to operational areas to minimize and/or eliminate breaches in the future and, utilized 
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the CCH Sanction Policy and Personnel Rules, to provide leadership guidance for 
disciplinary action. 

2 . Breach Notification. Investigated all instances of lost or stolen patient information, 
including paper and electronic. For all instances in which the data loss constitutes a 
breach as defined by the Breach Notification Rule, the breach notification 
requirements to the patient, the Secretary of HHS, and the media are completed. 
Corrective action plans are created and executed to improve the processes and counsel 
the physicians and employees involved. 

3 . Conflict of Interest. Provided guidance and developed Conflict Management Plans 
to preserve the integrity of the decision-making process. 

4 . Investigations Resulting in Employee Related Corrective Actions. HIPAA 
and Conflict of Interest complaints were investigated and resulted in providing 
leadership guidance to remediate the situations and avoid repetition of the incident. 

5 . Partnerships with Governmental Agencies. Corporate Compliance has engaged 
both state and federal agencies (e.g. the Department of Healthcare and Family Services 
(HFS) Office of the Inspector General, Medicaid Fraud Control Unit, Office for Civil 
Rights, Federal Bureau of Investigations, and the Secret Service) on a variety of 
matters. Additionally Compliance has worked with the Cook County Office of the 
Independent Inspector General. 

Element 6 

The use of audits and/or other evaluation techniques to monitor compliance and assist in the 

reduction of identified problem area. 

F. Auditing and Monitoring 

1 . The Corporate Compliance Program conducted ongoing HIPAA auditing and 
monitoring during the relocations out of the Administrative building as follows: 

o Providing proactive record retention guidance throughout the move; 
o Monitoring garbage bins and vacated offices for PHI and working with 
operational leadership to educate staff when PHI was found; 
o Engaging Health Information Management when original medical record 
information was identified; 

o Communicating to the appropriate operational area(s) when other non-HIPAA 
contacts were identified related to the move (e.g. sharps and equipment found.) 

2 . The Corporate Compliance Program also served a resource to Internal Audit for 
outpatient coding expertise. 
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G. Risk Assessment 

The Corporate Compliance Program risk assessment process is dynamic and adjustments 
are made throughout the year to respond to emerging issues with the resources available. 
This report highlighted activities that minimized risk through the introduction and 
enforcement of policies and standards, auditing and monitoring, education, and issue 
investigations with corrective action plans as appropriate. 

Through surveys of executive leadership and key thought leaders within the organization, 
industry risks, and through the course of activities within prior fiscal years, the following 
areas were assessed in FY18: 

■ Securing Protected Health Information in paper and electronic and paper format 
through encryption and secure storage devices; 

■ Monitoring patient data to ensure accurate registration and deter identity theft and 
merged electronic health records; 

■ Directing Supply Chain Management during contract negotiations in the areas of 
compliance, privacy and security; 

■ Ensuring documentation supports the services performed through accurate code 
assignment; 

■ Defining contractual parameters of governmental Managed Care Plans excluding 
CountyCare; 

■ Assuring sanction screening was performed during the onboarding process for 
employees and vendors; 

■ Monitoring the 340B Drug Pricing Program through Pharmacy; 

■ Collaborating with Research to ensure regulatory requirements are followed; 

■ Guiding leadership in Record Retention and Storage requirements; and 

■ Working with physicians through the Illinois Drug Prescription Monitoring 
Program to eliminate fraudulent controlled substance prescriptions. 


Element 7 

The investigation and remediation of identified systemic problems and the development of 
policies addressing the non-employment or retention of sanctioned individuals. 

Sanction Screening Checks 

■ Continued to address regulatory requirements to avoid employing, engaging, 
contracting or agreeing with any individual or entity that is excluded or 
“sanctioned” from participation in a federal health care program or who is 
debarred from participation in federal procurement or non-procurement 
programs for the provision of goods or services. 

■ Determined, through an independent third party, no excluded or sanctioned CCH 
workforce members or vendors were identified throughout this fiscal year. 


Page 16 


37 of 65 






Cook County Health 

Compliance Program 

ANNUAL REPORT - FY18 


V. Looking Ahead 


Overarching priorities have been established for CCH Corporate Compliance, to: 

■ Serve as a resource for our patients, our staff, and the public at large; 

■ Investigate all contacts/complaints brought to the attention of the Program; 

■ Promote the CCH Corporate Compliance Program internally and externally. 

In addition, as noted earlier, through an annual risk assessment with executive leadership and 
key thought leaders, identification of emerging issues, and through the course of activities within 
prior fiscal years priorities have been identified. The Corporate Compliance Program will 
primarily focus on analysis and risk reduction related to fraud, waste, and abuse initiatives and 
continue to review, update and implement compliance policies and procedures. 

FY19 priorities on the CCH provider side will focus on the following: 

■ Communication of importance of safeguarding hard copy Protected Health Information 
(PHI) to workforce members and their departments and provide guidance on record 
retention parameters and secure destruction processes as warranted; 

■ Development and compilation of a leaner, intuitive Records Retention Schedule for 
submission to the Local Records Commission. Once approved, append the current 
Records Retention policy and communication the update to the CCH workforce; 

■ Continuation of our partnership with IT Security to examine processes to safeguard 
electronic protected health information or ePHI as technological challenges arise (e.g. 
social media, texting, image sharing, etc.); 

■ Collaboration with Revenue Cycle operations to deter identity theft and merged electronic 
health records; 

■ Participation in continued oversight of the 340B Drug Pricing Program; 

■ Communication to accentuate the need for providers to manage their prescription activity 
with the Illinois Drug Prescription Monitoring Program to eliminate fraudulent controlled 
substance prescriptions; 

■ Oversight of auditing and monitoring code assignment based on medical record 
documentation and documentation guidelines; and 

■ Assessment of compliance with third party Managed Care contracts. 
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I. Introduction 


CountyCare is a Managed Care Community Network (MCCN) health plan offered by Cook County 
Health (CCH) pursuant to a contract with the Illinois Department of Healthcare and Family 
Services (HFS). Since late 2012, CCH has partnered with the State of Illinois, initially through the 
State of Illinois federal Section 1115 demonstration waiver which was an early start on Medicaid 
expansion, then in 2014, CountyCare transitioned into the MCCN. By working to employ the 
advantages of our parent organization, CCH, CountyCare is able to uniquely promote achievement 
of the Triple Aim: 1) improving the member experience, 2) improving the health of populations 
overall, while 3) reducing the cost of care. The operation of the CountyCare MCCN is facilitated 
through CCH and its various subcontractors. 

To adhere to the Centers for Medicare & Medicaid Services (CMS) Managed Care Program 
Integrity requirements 1 , contractual provisions in the MCCN Agreement with HFS, and the 
elements of an effective compliance program as recommended in the Department of Health and 
Human Services Office of Inspector General (OIG) Compliance Program Guidance publications, 
CountyCare developed and implemented the CountyCare Compliance Program. The CountyCare 
Compliance Program is designed to demonstrate the health plan’s ongoing commitment to 
promoting ethical and lawful conduct consistent with all applicable laws, regulations, and 
contractual requirements, as well as CCH policies, procedures, and Code of Ethics/Standards of 
Conduct. 

This Annual Report presents the activities throughout county fiscal year 2018. The CountyCare 
Managed Care Compliance Program is under the executive leadership of Cathy Bodnar, Chief 
Compliance and Privacy Officer, and the operational leadership of Elizabeth Festa, CCH 
Compliance Officer dedicated to CountyCare. 

During this past fiscal year, CountyCare Health Plan, as a whole, accomplished many goals and 
implemented a variety of initiatives. A few health plan achievements include: 

■ CountyCare Became the Largest Medicaid Health Plan in Cook County : In FY2018, 
CountyCare acquired the Medicaid membership of both Aetna and Family Health Network 
(FHN), becoming the largest Medicaid Health Plan in Cook County. 

■ Medicaid Redetermination Efforts : CountyCare sought to retain membership by helping 
members with their Medicaid redetermination process. Triggers were developed for 
providers, prompts were embedded within providers’ health information systems, and 
redetermination events throughout the county were held to help members maintain their 
Medicaid eligibility and CountyCare membership. 

■ CMS Review of Illinois Medicaid Program Integrity Activity : CMS conducted a focused 
review of Illinois Medicaid to determine the extent of program integrity oversight of the 
managed care program at the state level and to assess the program integrity activities 
performed by a random selection of the state’s managed care organizations. CountyCare 


1 See 42 C.F.R. §438.608._ 
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was selected, supplied numerous documents to support program integrity efforts, and 
Corporate Compliance travelled to Springfield to participate in interviews with CMS and 
HFS, strengthening its relationship with both entities and providing valuable insight into 
the Program Integrity activities of CountyCare. 

The Corporate Compliance Program dedicated to CountyCare was directly involved in each major 
initiative to assure the execution adhered to and incorporated relevant regulatory directives and 
contractual requirements. 


II. Building Blocks - Program Infrastructure and Scope 


The Annual Report begins with a look at the structure and activities of the Program that 
incorporate efforts to foster an infrastructure that produces a comprehensive compliance 
program for CountyCare and its affiliates. The existing Departmental Organization Chart follows: 


Compliance Organization Chart 


CCHHS 

Board of Directors 


Audit & Compliance 
Committee of the 
Board 



CCHHS 

Chief Executive Officer 







The lightly shaded positions indicate the new hires within FY18. Two (2) of the 3-dedicated 
CountyCare Compliance Program positions were vacant for several months within the fiscal year, 
including the Compliance Officer assigned to CountyCare. This placed a significant strain on the 
existing resources. In the interim, Cathy Bodnar, functioned in an operational leadership capacity 
with significant, noteworthy support from Cory Otto, Compliance Analyst. Management of the 
core elements of the Program continued which was critical to the ongoing success of the 
CountyCare Compliance Program. 
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CountyCare Compliance Program Scope 

The CountyCare Compliance Program is tasked with outlining guidelines and providing insight 
to: 

■ Comply with the CMS Managed Care Program Integrity requirements and the terms of the 
CountyCare Health Plan contract with HFS; 

■ Prevent, detect and eliminate fraud, waste, abuse, and financial misconduct; 

■ Protect health plan members, providers, CCH, the State, and the taxpaying public from 
potential fraudulent activities; 

■ Respond and provide guidance related to privacy, confidentiality, and security matters; 

■ Provide high level oversight to the health plan’s Grievances and Appeals Program; and 

■ Understand and focus on high-risk areas that have the greatest potential for non- 
compliance with federal and state regulatory and contractual requirements. 

Further, the program aims to implement a working communication strategy to increase the 
CountyCare workforce awareness, including vendors and subcontractors, of the following topics: 

■ Code of Ethics; 

■ Privacy, Confidentiality, and Security; 

■ Accessibility of the Compliance Officer and the compliance team; 

■ Availability through multiple modalities; 

■ Responsibility to report potential/actual issues; 

■ Consequences of not reporting; and 

■ Non-retaliation. 

The following types of activities fall into the CountyCare Compliance Program purview: 

■ Interpretation of contracts, laws, rules, regulations, and organizational policy as they 
relate to CountyCare Compliance 

■ Accurate Books and Records 

■ Anti-kickback Activities 

■ Conflict of Interest 

■ False Claims 

■ Financial Integrity 

■ Fraud, Waste and Abuse 

■ Member Privacy, Confidentiality, and Security (HIPAA) 

The CountyCare Compliance Program scope of work is subject to ongoing review and revision as 
deemed necessary to ensure ongoing compliance. It is designed to accommodate future changes 
in regulations and laws and may be updated to address activities not currently covered, issues 
related to new service offerings, or regulatory requirements. 
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III. Compliance Program Structure — Performance of the Elements 


This section of the report serves to demonstrate the effectiveness and provide an assessment of 
program operations using the seven (7) Compliance Program Elements of a comprehensive 
compliance program, as outlined in the CMS Managed Care Program Integrity requirements 2 and 
by contractual provisions in the MCCN Agreement. 

Element 1 

The distribution of written Code of Ethics, as well as written policies and procedures that 
promote the health plan’s commitment to compliance (e.g., by including adherence to 
compliance as an element in evaluating managers and employees) and that address specific 
areas of potential fraud, waste and abuse. The CCH Code of Ethics applies to all CountyCare 
personnel, providers, agents and subcontractors. The Code of Ethics, as well as CCH’s policies 
and procedures, support CountyCare’s commitment to comply with all federal and state 
standards, including but not limited to, applicable statutes, regulations and sub-regulatory 
guidance and contractual requirements. 

A. Policies and Procedures. 

Compliance staff engaged in the following activities to promote and establish an effective 
compliance program for the CountyCare Health Plan: 

1. Incorporated new and revised 2018 MCCN contractual language into vendor 
contracts and Requests for Proposals. 

2. Continued to follow the CountyCare Compliance Plan that focuses exclusively on 
outlining the compliance responsibilities of the health plan and program design 
for implementation, as well as specific CountyCare compliance policies for high 
risk areas focused on health plan operations. 

3. Ensured that CountyCare personnel, providers, agents and subcontractors had 
access to compliance documentation electronically and were provided with hard 
copies of compliance policies and procedures upon request. 

4. Obtained copies of compliance related policies and procedures, where needed, 
from Evolent, CountyCare’s Third-Party Administrator (TPA) and the various 
delegated vendors providing services for CountyCare. 

5. Reviewed, in conjunction with the TPA, twenty-four (24) policies addressing the 
following areas, 

o Fraud, Waste, Abuse, and Financial Misconduct; 
o Compliance Auditing and Monitoring; 
o Provider Audit and Recovery and Appeals Process; 
o Compliance Reporting and Non-Retaliation; 

o Exclusion Screening, License Verification, and Background Checks; 
o Conflict of Interest; 
o Delegated Entity Oversight/Monitoring; 


2 See 42 C.F.R. §438.608._ 
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o Health Plan Marketing; and 
o Subpoena Handling. 

Ad Hoc Activities/Guidance 

Corporate Compliance worked with operational areas to assess compliance with 
policies, procedures and/or regulatory requirements and, in certain instances, assisted 
in the development of new policies and procedures. 

Examples of areas assessed: 

■ Health Plan Marketing Policy Compliance Review : Due to the ever-changing 
complex regulatory environment of Medicaid managed care plan marketing, 
Compliance reviewed and tracked all marketing materials before they were 
submitted to HFS for approval. In FY18, Compliance conducted 37 marketing and 
material reviews. 36 of 37 reviews conducted were approved by Compliance and 
subsequently, HFS. Each CountyCare initiative reviewed may contain multiple 
materials, however, each review is counted individually. 



Member 
Notification/ 
Letter 
Initiatives 
27% 


Health Plan 
Education & 
Member Materials 
19% 


Promotional Items 
3% 


Social Media, 
Billboard, Radio, 
and Other 

19% 


Policy, MCCN, and 
NCQA Related 
Initiatives 
8 % 


Preferred Provider 
Initiatives 
8 % 


Member Incentive 
Program Initiatives 
16% 


■ Medical and Prior Authorization Policies : Worked with Evolent, CountyCare’s 
TPA, to compile all medical payment and prior authorization policies and to 
identify areas of need. 

■ Authorized Representatives : Provided written guidance to the member call center 
regarding when they could speak with a member’s representative based on a verbal 
consent. 
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■ Abuse. Neglect, and Exploitation : Analyzed and provided guidance to CountyCare 
operations on the role as a mandated reporter of Critical Incidents and potential 
Abuse, Neglect, and Exploitation of members. 

■ New Prior Authorization and Utilization Management System : Partnered with the 
CountyCare Quality Department to ensure the upgraded method for 
communicating prior authorizations and delivering care management comports 
with accepted privacy and security standards. 


Element 2 

The designation of a Chief Compliance Officer and other appropriate bodies, e.g., a corporate 
compliance committee, charged with the responsibility of operating and monitoring the 
compliance program, and who reports directly to the CEO and the governing body. 

C. Compliance Office and Committees 

Cathy Bodnar, the Chief Compliance and Privacy Officer, reports to both the CCH Audit & 
Compliance Committee of the Board and the CCH Chief Executive Officer. In turn, the 
CCH Audit & Compliance Committee of the Board and the CCH Chief Executive Officer 
each report to the CCH Board of Directors. 

The CCH Compliance Officer responsible to assist the Chief Compliance and Privacy 
Officer in the operation of the CountyCare Compliance Program is Elizabeth Festa. The 
primary duties of the Compliance Officer assigned to CountyCare include the following: 

■ Serving in a leadership capacity to develop the CountyCare Compliance Program 
in conjunction with the Chief Compliance and Privacy Officer; 

■ Collaborating with CountyCare operational leadership to facilitate operational 
ownership of compliance; 

■ Overseeing the Plan’s Program Integrity Program; 

■ Participating in CountyCare risk assessments to understand potential 
vulnerabilities; 

■ Establishing a structured process for regulatory review, monitoring, and 
dissemination of information related to Corporate Compliance; 

- Periodically revising the Corporate Compliance Program Plan, with input from the 
Audit & Compliance Committee of the Board of Directors and Executive 
Management in light of changes directed to the needs of the health plan and the 
laws and policies of federal, state, and county bodies; 

■ Modifying policies, procedures, and projects to reflect changes in laws and 
regulations; 

■ Developing and coordinating compliance projects with CountyCare and delegated 
vendors; 

- Performing interviews with all key personnel to validate compliance with 
established policies and procedures and applicable regulations in conjunction with 
other personnel, as deemed necessary; 
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■ Completing ongoing assessments to evaluate potential strengths and weaknesses 
and to determine the adequacy of the overall CountyCare Corporate Compliance 
Program to ensure compliance, as deemed necessary; 

- Providing guidance related to HIPAA and information sharing; 

■ Monitoring the health plan’s Grievances and Appeals Program for patterns and 
trends while providing high level oversight; 

- Providing recommendations to correct any potential weaknesses or areas of non- 
compliance discovered; and 

■ Performing follow-up reviews to ensure action plans have been adequately 
implemented. 

The Audit & Compliance Committee of the Board advises the CCH Board of 
Directors regarding the implementation of standards and processes to assure professional 
responsibility and honest behavior, compliance with regulatory requirements, and risk 
management. The Audit & Compliance Committee of the Board receives periodic updates 
regarding the CountyCare Compliance program, including Fraud, Waste and Abuse 
(FWA) metrics and assessments of risk areas. 

The CountyCare Compliance Committee, chaired by the Compliance Officer 
assigned to CountyCare, meets monthly and provides oversight of and guidance to 
CountyCare operations to ensure regulatory compliance and fulfill Compliance Program 
requirements, which include the implementation and operation of the Compliance 
Program. The Compliance Committee also reviews CountyCare activity pursuant to 
Compliance Program requirements and contractual requirements, including, but not 
limited to audits, monitoring activity, and corrective action plans. The Committee reports 
through the Chief Compliance and Privacy Officer to the Audit & Compliance Committee 
of the Board. 

The Fraud, Waste and Abuse Workgroup, chaired by the CountyCare Compliance 
Officer with attendance by the Chief Compliance and Privacy Officer, transitioned from a 
monthly workgroup meeting to hoc committee convened to review the structure and 
effectiveness of the fraud, waste and abuse detection efforts. 

The CountyCare Executive Committee is comprised of CCH senior delegates and 
CountyCare leadership and is responsible for providing oversight, guidance and support 
to CountyCare leadership to support the achievement of agreed upon goals in a manner 
consistent with a provider-sponsored organization. The Committee provides useful 
feedback to CountyCare leadership regarding Plan performance and promotes alignment 
between CCH objectives and CountyCare programs. The Committee meets once every two 
months. 

The HFS-OIG MCO Subcommittee is comprised of HFS-OIG and Managed Care 
Organization’s (MCO) compliance members involved in the program integrity functions 
of their respective MCOs. This subcommittee meets monthly to review and share 
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information regarding fraud, waste, and abuse activity as it relates to specific providers 
and trends. 

Corporate Compliance Program Integrity Meetings with delegated vendors occur on 
a weekly, bi-weekly, and monthly cadence, depending on the vendor and amount of 
activity. Corporate Compliance oversees the vendors’ activities and uses these meetings 
to approve, modify, or reject the direction of investigations and recoupment activity. 

The Delegated Vendor Oversight Committee meets quarterly to provide oversight 
of the operations affecting the scope of functions of delegated vendors and subcontractors 
to ensure compliance with statutory and contractual requirements. The Committee also 
provides oversight of quarterly delegation audits, monthly joint operations meetings and 
regular monitoring of member and provider complaints. Identified areas of risk that fall 
under the purview of Corporate Compliance are referred to Corporate Compliance for 
assessment. 

Element ^ 

The development and implementation of regular, effective education and training programs for 

all affected employees. 

D. Education and Training 

1. CountyCare - Provider MCCN Onboarding and New Employee/Contractor 
Orientation 

■ Reviewed and updated provider onboarding orientation materials to fully 
incorporate corporate compliance requirements. 

2. Targeted Education 

■ Reviewed the MCCN Agreement for CountyCare training requirements and 
responsibilities and compared training materials submitted by the TPA and 
other delegated vendors to ensure compliance. 

■ Provided regulatory summary regarding updates to 42 CFR Part 2 related 
to the disclosure of substance/alcohol abuse records. 

■ Conducted a “HIPAA for Care Coordinators” and “HIPAA for Customer 
Service Members” targeted training for staff who work directly with 
members. Educated providers and care coordinators through guidance 
documents regarding HIPAA and information sharing for care 
coordination purposes. Created additional documents about HIPAA for 
care coordination staff who were part of the acquisition of FHN and Aetna 
membership. 

■ Provided guidance to CountyCare employees regarding Power of Attorney 
documents and authority. 

3. Annual CCH Compliance Education 

■ Reviewed mandatory CCH training requirement to ensure that CCH 
trainings paralleled contractual and regulatory requirements for the health 
plan workforce. Identified need to include Critical Incident training for 
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CountyCare staff; reviewed classroom training content to validate 
contractual requirement was met. 


Element 4 

The maintenance of a process, such as a hot line, to receive complaints, and the adoption of 
procedures to protect the anonymity of complainants and to protect whistleblowers from 
retaliation. 

E. Effective Lines of Communication — Receiving and Responding to 
Complaints 

1. Infrastructure Activities 

■ Monitored TPA’s support and assistance to CountyCare members through the 
TPA’s hotline service. Met weekly with TPA’s compliance staff to discuss 
contacts received through the hot line and appropriate follow-up/responses. 

■ Shared the accessibility of reporting concerns to the CountyCare workforce 
through: 

o A hotline service by a third party to preserve anonymity if desired; 
o A separate toll-free number for privacy breaches. 

o Open door policies of both the Compliance Officer assigned to CountyCare 
and the Chief Compliance and Privacy Officer; 
o Two (2) e-mail addresses for Compliance 

(compliance@cookcountvhhs.orgl and Privacy 
(privacv@cookcountvhhs.orgl . 

■ Established relationships and engaged internal and external resources to assist 
with investigations. 

■ Identified trends and patterns to mitigate organizational risks and facilitate 
operational improvement. 

■ Presented trends and patterns to the CountyCare Compliance Committee, 
CountyCare Executive Committee, Audit & Compliance Committee of the 
Board and the Managed Care Committee of the Board. 

2. Process for Responding to Contacts and Complaints 

Maintained processes for contact, complaint management, and resolution as 
follows: 

■ Investigated allegation; 

■ Determined the area(s) affected; 

■ Collaborated with operational leadership and appropriate entities; 

■ Reviewed and followed contractual obligations, organizational policy, federal, 
state, and county regulations related to the incident for mitigation and 
remediation; 

■ Determined and facilitated a resolution which may include a corrective action 
plan including education as needed; and 

■ Responded to the complainant, as appropriate. 
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3. Reporting 

Categories have been defined to allow CountyCare Compliance to accurately 
measure general compliance contacts. The inclusion of a contact in a specific 
category does not substantiate the contacts as a concern; rather it classifies the 
contact within a defined category. The contacts addressed within the past fiscal 
year of CountyCare as a MCCN fell into the following categories: 

■ Contractual Issues & Reviews 

■ Regulatory/Policy Matters 

■ HIPAA Privacy, Confidentiality and Security 

■ Accurate Books & Records 

■ Fraud, Waste and Abuse 

■ Conflict of Interest 

■ Other (e.g., subpoenas, unique grievance & appeals guidance, involuntary 
discharge of CountyCare member, etc.) 

4. Fraud, Waste and Abuse 

Prevention, detection and elimination of fraud, waste, abuse, and financial 
misconduct is a key driver for CountyCare Compliance. Benefit and Program 
Integrity is critical not only because it a contractual requirement and a significant 
focus by the State and Federal government but because it is the right thing, to do . 
The impetus of this key initiative is to ensure that federal, state, and county 
taxpayer dollars are spent appropriately on delivering quality, necessary care and 
preventing fraud, waste, and abuse in addition to protecting health plan members 
and providers. 

To identify potential fraud, waste, abuse, and financial misconduct, CountyCare 
Compliance partners with each delegated vendor through their dedicated areas 
commonly known as Special Investigation Units (SIU). The CountyCare 
Compliance Officer provides direct oversight of program integrity activity. 




Page 12 


50 of 65 
















Cook County Health 
CountyCare Compliance Program 

FY18 ANNUAL REPORT - December 2017 through November 2018 

All Program Integrity activity is tracked by State Fiscal Year (S-FY) for state 
reporting purposes and not by county fiscal year. The S-FY runs from July 1 st 
through June 30 th . 

FWA activity matters are raised through multiple modalities, to each delegated 
vendor or directly to Corporate Compliance. All allegations are tracked and 
monitored to resolution. In addition, other measures are undertaken through the 
SIUs. CountyCare utilizes data mining to identify providers with aberrant billing 
patterns and researches tips received from HFS, HFS-OIG, other Managed Care 
Organizations (MCOs), healthcare fraud groups, CountyCare employees, the 
media and other sources to identify overpayments. 

Metrics for the S-FY18 follow: 


Reporting 

Quarter 

Tips 

Preliminary 

Investigations 

Full 

Investigations 

Referrals to 
HFS-OIG 

Audits 

Overpayments 

Identified 

Overpayments 

Collected 

Qi 07/01 - 
09/30/17 

1 

11 

3 

3 

3 

$ 

97,910.84 

$ 

2,574.00 

Q2 10/01 - 
12/31/17 

2 

8 

9 

1 

1 

$ 

201,038.64 

$ 

2,961.36 

03 01/01 - 
03/31/18 * 

70 

5 

15 

2 

103 

$ 

457,245.29 

$ 

6,097.85 

04 04/01 
- 06/30/18 

6 

5 

9 

2 

57 

$ 

2,305,95974 

$ 

28,216.99 


* The 3 rd Quarter S-FY 18 was significant for CountyCare Compliance. Evolent, 
CountyCare’s TPA for medical and behavioral health, hired two (2) local 
investigators dedicated solely to program integrity efforts. This dedicated team 
partnered with a data analytics firm to review claims for anomalies. The result of 
this activity is apparent in the metrics above. 

CountyCare Compliance monitored the process to ensure that appropriate action 
was taken, including reporting of suspected FWA to the State HFS-OIG. 

In S-FY 2018, CountyCare referred 11 cases to the HFS-OIG for possible fraud, 
waste or financial misconduct. 

5. Total Volume of General Compliance Contacts 

In addition to the program integrity efforts above, a total of 125 general compliance 
contacts were tracked by CountyCare Compliance during the last fiscal year. This 
is a 29% decrease from last year. As noted earlier in this annual report, two (2) of 
the three (3) dedicated CountyCare Compliance Program positions were vacant. 
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This placed a significant strain on the existing resources from March through 
August 2018. CountyCare Compliance had one full-time Compliance Analyst, Cory 
Otto. In the interim, Cathy Bodnar, functioned in an operational leadership 
capacity and with external resources providing supplemental assistance. 

6. Contact Breakdown by Category (December 1, 2017-November 30, 2018) 



Fraud, Waste, & Abuse 

2% 


Re^ulatorv/Policv 


Other 


Accurate Books St Records 
1% 


Conflict of Interest 
156 


Contracts 

22 ^ 


Categories 

HIPAA (Privacy/Security) 

47 

Conflict of Interest 

2 

Regulatory / P olicy 

37 

Accurate Books & Records 

2 

Contracts 

27 

Human Resources 

1 

Fraud Waste & Abuse 

3 

Other 

6 


With limited resources, CountyCare Compliance focused on contacts and issues 
that presented, shifting the balance from proactive to reactive or unanticipated 
queries or concerns. Of the 125 CountyCare contacts in FY 18, 40% or 50 contacts, 
were proactive. This was a significant decrease Proactive 

from the previous fiscal year, where 81% of the 
contacts were proactive activities that 
anticipated possible issues. The gradual return 
to a proactive paradigm is anticipated with the 
resolution of staffing issues. 

Reactivi? 

60% 
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7. HIPAA (Privacy and Security) 

As a covered entity, the health plan is required to safeguard privacy for plan 
members. Privacy and security of member information is highly regulated, and 
this category accounted for 47, or 38% of all contacts handled by compliance. 

During FY2018, CountyCare had fifteen (15) HIPAA incidents. None of the 
incidents required notifications to members. Twelve (12) of the fifteen (15) 
incidents were misdirected communications sent to another covered entity 
(another health plan, for example) or business associate (an entity doing business 
on behalf of the health plan). 

8. Grievances and Appeals Activities 

The responsibility for Grievance and Appeals activity transitioned from Corporate 
Compliance to CountyCare Operations this fiscal year, specifically to leadership 
within Quality and Risk Management. CountyCare Compliance provides high- 
level oversight and remains committed to ensuring that contractual and regulatory 
timeframes are met, to providing guidance and assistance when necessary, and 
participating in the quarterly CountyCare Grievance and Appeals Committee. 

Element ^ 

The development of a system to respond to allegations of improper/illegal activities and the 
enforcement of appropriate disciplinary action against employees who have violated internal 
compliance policies, applicable statutes, regulations or Federal health care program 
requirements. 

F. Enforcing Standards 

Broadened the scope of Standards enforcement through: 

1. Fraud, Waste and Abuse Monitoring. As noted earlier in this report, 
CountyCare Compliance collaborated closely with the Special Investigation Units 
of Delegated Vendors to identify potential fraud, waste, abuse, and financial 
misconduct. Towards the end of the county fiscal year, Evolent, CountyCare’s TPA 
for medical and behavioral health shifted to a second data analytics firm 
recognized for its expertise in DRG auditing and coding analysis. 

2. Privacy and Security (HIPAA) Breach Assessments. As staffing for 
CountyCare Compliance stabilized, the area began to assume a greater 
responsibility for performing breach assessments. To maintain consistency in the 
approach, CountyCare Compliance partnered with CCH Provider Compliance to 
review allegations. If a privacy or security breach is validated, CountyCare 
Compliance provided remediation guidance to operational areas to minimize 
and/or eliminate breaches in the future and, utilized the CCH Sanction Policy and 
Personnel Rules, to provide leadership guidance for disciplinary action. 
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3. Investigations Resulting in Employee Related Corrective Actions. 

Investigated Conflict of Interest and confidentiality complaints and provided 
employee guidance. 

4. Partnerships with Governmental Agencies. CountyCare Compliance 
partnered with the HFS, HFS-OIG, and Illinois’ Medicaid Fraud Control Unit 
(MFCU). 

5. Partnerships with non-Governmental Agencies. CountyCare Compliance 
was invited to participate with a number of new organizations related to the 
detection of fraud and wrongdoing in the insurance industry. These non¬ 
governmental organizations include the Healthcare Fraud Prevention Partnership 
(HFPP), National Insurance Crime Bureau (NICB), and Midwest Anti-Fraud 
Insurance Association (MAIA). 


Element 6 

The use of audits and/or other evaluation techniques to monitor compliance and assist in the 
reduction of identified problem areas. 

G. Auditing and Monitoring 

■ Fraud. Waste. Abuse and Financial Misconduct 

As noted earlier in this report, CountyCare Compliance continued its partnership with 
SIUs, meeting regularly to build a robust system to identify potential financial 
misconduct, and formed partnerships with governmental and non-governmental 
agencies. 

■ Annual Compliance Attestation 

CountyCare Compliance continued to utilize an Annual Compliance Attestation, 
issued to all CountyCare’s delegated vendors in April 2018. The Compliance 
Attestation required all vendors to attest to several compliance provisions in their 
contracts, including distribution of a Code of Ethics, FWA policy distribution, training 
and education requirements, sanction screening checks, and delegated oversight. All 
of the vendors responded, and one vendor required corrective measures. 

H. Risk Assessment 

The focus within CountyCare Compliance is prevention, detection and elimination of 
fraud, waste, abuse, and financial misconduct, however other areas of risk relating to 
member privacy and security of protected health information were identified in FY18. 
These also require ongoing assessment: 

■ Necessity for updated procedures to terminate employee access to 3 rd party 
electronic systems upon separation from employment and to monitor current 
employee access. 

■ Disclosure and sharing of member sensitive health information. 
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In addition, CountyCare Compliance will initiate an annual risk assessment with executive 
leadership and key thought leaders nationally to identify outstanding risks and challenges 
to meeting the standards of an effective health plan compliance program. 

Element 7 

The investigation and remediation of identified systemic problems and the development of 
policies addressing the non-employment or retention of sanctioned individuals. 

I. Identification of Systemic Issues 
■ Sanction Screening Checks 

Addressed regulatory requirements to avoid employing, engaging, contracting or 
agreeing with any individual or entity that is excluded or “sanctioned” from 
participation in a federal or state health care program or who is debarred from 
participation in federal procurement or non-procurement programs for the provision 
of goods or services through ongoing monthly checks with an external vendor. 


IV. Looking Ahead 


In FY19 the Corporate Compliance Program will continue to focus on maintaining adherence to 
contractual requirements and healthcare compliance best practices as the program matures. As 
CountyCare relies heavily on delegated vendors, monitoring for adherence to CountyCare policies, 
contractual, and regulatory standards are critical to avoid sanctions. The Program will continue 
ongoing activities related to risk reduction in the areas of compliance, policy implementation, and 
the development and implementation of monitoring and auditing efforts. 

These priorities have been established for the CountyCare Compliance Program: 

■ Strengthen health plan oversight in the area of fraud, waste and abuse, 

o Foster continued partnerships with HFS-OIG and the State’s MFCU to develop 
best practices in Corporate Compliance for CountyCare. 
o Enhance relationships with non-government organizations and other MCOs’ SIUs 
to build a network of skilled investigators and increase effective Program Integrity 
efforts. 

■ Continue to investigate all matters brought to the attention of the Program. 

■ Uphold compliance with contractual requirements and industry best practices as 
CountyCare continues as the largest Medicaid Managed Care Organization in Cook 
County. 

■ Foster partnerships with CountyCare Operations and delegated vendors to fulfill 
contractual obligations in Program Integrity and state reporting. 

■ Increase oversight and monitoring for all delegated vendors. 

■ Serve as a resource to the workforce and delegated vendors. 

■ Mature the CountyCare Compliance Program and continue to incorporate best practices 
to cultivate a culture of compliance throughout the health plan. 

■ Maintain CountyCare Compliance Program recognition locally and nationally. 
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Internal Audit Charter 


(The following 3 slides are excerpts from the Institute of Internal Auditors (IIA) Practice Standards) 

INTERNATIONAL STANDARDS FOR THE PROFESSIONAL PRACTICE 
OF INTERNAL AUDITING (STANDARDS) 

Attribute Standards 


1000 - Purpose, Authority, and Responsibility 

The purpose, authority, and responsibility of the internal audit activity must be formally 
defined in an internal audit charter, consistent with the Definition of Internal Auditing, the 
Code of Ethics, and the Standards. The chief audit executive (CAE) must periodically 
review the internal audit charter and present it to senior management and the board for 
approval. 

Interpretation: 

The internal audit charter is a formal document that defines the internal audit activity's 
purpose, authority, and responsibility. The internal audit charter establishes the internal 
audit activity's position within the organization, including the nature of the chief audit 
executive's functional reporting relationship with the board; authorizes access to records, 
personnel, and physical properties relevant to the performance of engagements; and 
defines the scope of internal audit activities. Final approval of the internal audit charter 
resides with the board. 
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Internal Audit Charter 


1110 - Organizational Independence 

The chief audit executive must report to a level within the organization that allows the internal audit activity 
to fulfill its responsibilities. The chief audit executive must confirm to the board, at least annually, the 
organizational independence of the internal audit activity. 

Interpretation: 

Organizational independence is effectively achieved when the chief audit executive reports functionally to 
the board. Examples of functional reporting to the board involve the board: 

Approving the internal audit charter; 

Approving the risk based internal audit plan; 

Approving the internal audit budget and resource plan; 

Receiving communications from the chief audit executive on the internal audit activity’s performance relative to its plan and 
other matters; 

Approving decisions regarding the appointment and removal of the chief audit executive; 

Approving the remuneration of the chief audit executive; and 

Making appropriate inquiries of management and the chief audit executive to determine whether there are inappropriate scope or 
resource limitations. 
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Internal Audit Charter 

Considerations for Implementation 

Based on this foundational work, the CAE (or a delegate) drafts an internal audit charter. The IIA offers a model internal audit activity charter 
that may be used as a guide. Although they vary by organization, charters typically include the following sections: 

Introduction - to explain the overall role and professionalism of the internal audit activity, citing the relevant elements of the International 
Professional Practice Framework (IPPF). 

Authority - to specify the internal audit activity's full access to the records, physical property and personnel required to perform its 
engagements and to declare its accountability for safeguarding assets and confidentiality. 

Organization and Reporting Structure -to document the CAE's reporting structure. The CAE reports functionally to the board and 
administratively to a level within the organization that allows the internal audit activity to fulfill its responsibilities. This section may delve into 
specific functional responsibilities, such as approving the charter and audit plan, and hiring, compensating, and terminating the CAE; as well as 
administrative responsibilities, such as supporting information flow within the organization or approving human resource administration and 
budgets. 

Independence and Objectivity - to describe the importance of internal audit independence and objectivity and how these will be maintained, 
such as prohibiting internal audit from having operational responsibility or authority over areas audited. 

Responsibilities - to lay out major areas of ongoing responsibility, such as defining the scope of assessments, writing an audit plan and 
submitting it to the board for approval, performing assessments, communicating the results, providing a written audit report, and monitoring 
corrective actions taken by management. 

Quality Assurance and Improvement- to describe the expectations for maintaining, evaluating, and communicating the results of a quality 
program that covers all aspects of the internal audit activity. 

Signatures - to document the agreement between the CAE, a designated board representative, and the individual to whom the CAE reports, 
with the date, name, and title of signatories. 
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Cook County Health and Hospitals System (CCHHS) 
Internal Audit Charter 


March 22,2018 


Mission 

Internal Audit is an independent, objective assurance and consulting activity designed to add 
value and improve an organization’s operations. It helps an organization accomplish its 
objectives by bringing a systematic, disciplined approach to evaluate and improve the 
effectiveness of risk management, control and governance processes. 

Internal Audit will align its activities with the mission and strategy of CCHHS. Internal Audit 
will promote good controls and serve as an educational resource to its stakeholders with respect 
to risk management, control and governance processes. Internal Audit will maintain a 
collaborative approach to its work practices and will ensure its work product provides value 
added outputs for its stakeholders. 

Role 

• Internal Audit’s role is determined by the CCHHS Board of Directors through its Audit and 
Compliance Committee. 

• Responsibilities are defined by the CCHHS Board of Directors through its Audit and 
Compliance Committee. 

Professional Standards 

• Internal Audit will govern themselves by adherence to the Institute of Internal Audit’s 
“Code of Ethics”, http://www.theiia.org/guidance/standards-and-guidance/ippf/code-of- 
ethics/english/ 

• The Institute’s “International Professional Practice Framework” shall constitute the operating 
procedures for the department. These documents are considered an addendum to this Charter. 
http://www.theiia.org/guidance/standards-and-guidance/ippf/standards/ 

• Internal Audit will adhere to all CCHHS policies and procedures and all Internal Audit 
procedure manuals. 

Authority 

Internal Audit is authorized to: 

• Have unrestricted access to all functions, records, property and personnel. 

• Have free, open, and timely access to the Chief Executive Officer and the CCHHS Board of 
Directors through its Audit and Compliance Committee. 

• Allocate department resources, set frequencies, select subjects, determine scope of work and 
apply the techniques required to achieve audit objectives. 

• Obtain the necessary assistance of personnel in the organization when performing audits, as 
well as other specialized services from within or outside the organization. 

Independence 

• All audit activities shall remain free of influence by any element in the organization, 
including matters of audit scope, procedures, frequency, timing, or report content, required to 
permit the independence required to render objective reports. 

• Internal auditors shall have no operational responsibility or authority over any activities they 
review. 

• Internal auditors shall not develop or install systems or procedures, prepare records or engage 
in any other activity that they would normally audit. 
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• Internal Audit reports functionally to the CCHHS Board of Directors through its Audit and 
Compliance Committee and administratively to the Chief Executive Officer. 

• Internal Audit periodically reports to the CCHHS Board of Directors through its Audit and 
Compliance Committee and to CCHHS Senior Leadership as outlined in the section on 
Accountability. 

Accountability 

Internal Audit is accountable to the CCHHS Board of Directors through its Audit and Compliance 
Committee and to CCHHS Senior Leadership to: 

• Report significant issues related to the process for controlling the activities of the 
organization, including potential improvements to those processes, and provide information 
concerning such issues through resolution. 

• Provide information periodically on the status and results of the annual audit plan and the 
sufficiency of internal audit resources. 

• Coordinate with and provide oversight of other control and monitoring functions. 

Audit Scope 

The scope of the work of Internal Audit is to determine whether the network of risk management, 

control and governance processes, as designed and represented by management, is adequate and 

functioning in a manner to ensure: 

• Risks are identified and managed. 

• Interaction with various governance groups occurs as needed. 

• Significant financial, managerial and operating information is accurate, reliable and timely. 

• Employee’s actions are in compliance with policies, standards, procedures and applicable 
laws and regulations. 

• Resources are acquired economically, used efficiently, and adequately protected. 

• Programs, plans and objectives are achieved. 

• Quality and continuous improvement are fostered in control processes. 

• Significant legislative or regulatory issues impacting the organization are recognized and 
addressed properly. 

Responsibility 

• Develop an annual audit plan using risk-based methodology, including any risk or control 
concerns expressed by management, and submit the plan to the CCHHS Board of Directors 
through its Audit and Compliance Committee and to CCHHS Senior Leadership for approval. 

• Implement the audit plan and any special requests by the CCHHS Board of Directors, its 
Audit and Compliance Committee, and CCHHS Senior Leadership and management. 

• Maintain a professional audit staff capable of meeting the requirements of this Charter. 

• Establish a quality assurance program whereby the director of internal audit assures the 
operations of internal audit. 

• Perform consulting services in addition to assurance services. Consulting services are defined 
as "‘advisory and related client services activities, the nature and scope of which are agreed 
with the client and which are intended to add value and improve the organization’s 
governance, risk management and control processes without the internal auditor assuming 
management responsibility.” Examples include counsel, advice, facilitation, and training. 

• Evaluate and assess significant merging/consolidating functions and new or changing 
services, processes, operations and control processes, coincident with their development, 
implementation and/or expansion. 
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• Issue periodic reports to the CCHHS Board of Directors through its Audit and Compliance 
Committee and to CCHHS Senior Leadership summarizing results of internal audit activities. 

• Inform the CCHHS Board of Directors through its Audit and Compliance Committee, and 
CCHHS Senior Leadership of emerging trends and successful practices in internal auditing. 

• Provide the CCHHS Board of Directors through its Audit and Compliance Committee, and 
CCHHS Senior Leadership a list of internal audit measurement goals and results. 

• Assist in the investigation of significant suspected fraudulent activities. 

• Consider the scope of work of the external auditors and regulators for the purpose of 
providing optimal audit coverage at a reasonable cost. 


Commissioner Jerry Butler 

Audit and Compliance Committee Chair 



Hill Hammock 
Chairman of the Board 



Tom Schroeder 
Director of Internal Audit 
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